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The European Data Protection Board 


Having regard to Article 68 and Article 69 of the Regulation 2016/679/EU of the European Parliament 
and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing 
of personal data and on the free movement of such data, and repealing Directive 95/46/EC, 
(hereinafter “GDPR”), 


Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended 
by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018, 


Having regard to Article 3, Article 21 and Article 22 of its Rules of Procedure as amended on 29 January 
2020, 


HAS ADOPTED THE FOLLOWING DOCUMENT 


EDPB GUIDANCE ON ITS PLENARY MINUTES 


1 PURPOSE AND SCOPE 


This document aims to guide the EDPB secretariat in drafting plenary minutes in the perspective of 
their publication. The purpose of the guide is to describe which elements need to be recorded (2) but 
also to analyse the impact of proactive publication of the minutes, and the possible need to redact 
some parts (3). The document also addresses the impact of a decision by the EDPB to consider the 
content of a discussion as being confidential (4). 


2 ELEMENTS TO RECORD IN THE MINUTES 


This section has been divided to cover the different categories of topics discussed during plenary 
meetings: general discussions, conclusions and informal votes (2.1), reports/updates by SAs or 
subgroups (2.2), formal votes (2.3) and tasks and deadlines (2.4). 

Article 21 (2) and (4) of the EDPB Rules of Procedure (“RoP”) provides the framework for the drafting 
guidance, which reads as follows: 

“the draft minutes shall include a summary of the discussions, a record of the conclusions reached, 
the decisions adopted, and as the case may be the numerical result of vote(s). It shall also include the 
list of documents submitted and their status. The positions of the supervisory authorities of the EFTA 
EEA States shall be recorded separately. The conclusions reached and the follow-up actions to be 
undertaken shall be summarized by the Chair at the end of discussions on each agenda point. A to- 
do-list shall be drafted by the secretariat and sent to the members, the expert subgroups and 
rapporteurs after approval of the Chair no later than one week after the meeting.” 


2.1 General discussions, conclusions and informal votes 
General discussions will not be recorded in detail, as according to Article 21 (2) RoP, the minutes 
should only contain a summary of the discussion. If the members discuss a topic without putting it to 
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a formal vote, typically several options are discussed but no definitive conclusion is reached. The 
main points discussed and the follow up actions(e.g. topic will be further discussed in next plenary or 
topic will be referred to subgroup) should be stated in the minutes. However, individual 
contributions should not be attributed to any specific SAs or speakers. Where relevant for future 
work, the results of an informal vote should be recorded. A summary explanation of the position of 
the members who voted against or abstained should be included in the minutes with the 
identification of the SA if it is explicitly requested by the SA in question. In such cases, the requesting 
SA should reason why its individual position should be recorded. Finally, if the plenary reaches a 
conclusion that would be useful for the follow up activities, it should be recorded pursuant to Article 
21 (2) RoP. 

Example: 

2.6 Exchange of SA's experiences regarding the recent reports relating to XX Company 

The members of the EDPB recognized the importance of a good exchange of information in general 
and in particular in the matter. After discussions, members of the EDPB agreed to have an address by 
the Commissioner for Data Protection of XXX at the next plenary meeting and a dedicated meeting of 
the Social Media ESG and the Enforcement ESG 


2.2 Reports/updates by SAs or Subgroups 

The SAs making an update or giving a report should be named in the minutes. However, individuals 
should not be named, unless it relates to publicly available information or to a public figure and the 
information is not private. As with general discussions, the information recorded should be kept 
brief. In most cases, it should be sufficient to state the topic for which a report is provided or an 
update is given and the information that the topic was discussed by the Board. In general, the 
individual delegations which participate in the discussions should not be named. In exceptional 
circumstances, the SAs which contributed to the discussion and the content of the discussion may be 
recorded. Such information should only be included in the minutes if it is explicitly requested by the 
SA in question. The SA should reason why it is exceptionally important that the information is 
recorded in this case. Updates from SAs on ongoing investigations frequently contain names of 
companies. In general, the names will be recorded. More information on possible exceptions to this 
general rule can be found in section 3 of this document. 


2.3. Formal Votes 

If a topic is put to a vote, the following information should be recorded: The topic which is the 
subject of the vote and the result of the vote. The number of votes in favour and against the motion 
as well as abstentions should be recorded. Individual votes should not be named by default. In 
accordance to Article 21 (2) of the RoP, the positions of the supervisory authorities of the EFTA EEA 
States shall be recorded separately. A summary explanation of the position of members who voted 
against or abstained should be included in the minutes with the identification of the SA if it is 
explicitly requested by the SA in question. 

This practice will be in line with the EDPB decision made during its 7th Plenary meeting: “The EDPB 
members agreed that a summary explanation of the position of members who voted against or 
abstained should be included in the minutes with the identification of the SA if it is explicitly 
requested by the SA in question”. 

Example: 


3.5.2. Translation of joint opinions 
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The EPDPB Secretariat presented the motion, that joint opinions should be translated in all EU 
languages.” 


Results of the vote: adopted 
X in favour; Y against; abstentions: Z 


X EEA EFTA SAs in favour; Y EEA EFTA SAs against; Z EEA EFTA SAs absenting 


2.4 Tasks and deadlines 


Only a brief description of the task and the subgroup or SA which the task has been mandated to 
should be mentioned in the minutes. Specific to-dos and deadlines should only be recorded in the to- 
dos document. Discussions relating to possible changes of working methods of the Board should also 
be recorded in the to-dos: 


Example: 
After discussions, members of the EDPB agreed to have: 
e 1h address by the Commissioner for Data Protection of XXX at the next plenary meeting (April); 


e a dedicated meeting on the 17 April 2019 of the Social Media ESG and the Enforcement ESG. The 
chairing of this meeting will be decided together with the Social Media ESG and the Enforcement ESG. 


3 POSSIBLE NEED TO REDACT INFORMATION RECORDED IN THE 
MINUTES BEFORE PUBLICATION 


Despite the commitment of the EDPB to offer the greatest transparency about its activities, it might 
be the case that some information will need to be recorded in the minutes but cannot be made 
available to the general public, as it falls within one or more exceptions of Article 4 of Regulation 
1049/2001. 

For instance, the EDPB may discuss ongoing investigations relating to particular companies. This kind 
of information may be redacted, if an exception under Regulation 1049/2001 would justify a 
rejection of an access request ( For example, under Article 4(1) (b) second indent of Regulation 
1049/2001, the protection of commercial interests may justify the denial of access to documents, 
unless there is an overriding public interest in disclosure). Other items could be subject to a redaction 
in case, for example, the disclosure of the information would seriously undermine the decision- 
making process of the EDPB and there is no overriding public interest in such disclosure (Article 4 (3) 
Regulation 1049/2001). 

References to internal documents may be redacted if it is duly justifiable under Regulation 
1049/2001. The EDPB Secretariat will carefully provide legal assistance to the members regarding 
their decision to not publish documents. 


1 See minutes of 7th Plenary, 1.1. 
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In practice, when sharing the draft minutes with the EDPB members for comments and approval 
prior to the next plenary meeting, the EDPB Secretariat will highlight the elements which, according 
to its legal analysis, should be redacted when publishing the minutes. 

When publishing the redacted minutes, the following text will be inserted at the beginning of the 
minutes: 

“Some points have been redacted from these minutes as their publication would undermine the 
protection of one or more of the following legitimate interests, in particular: the public interest as 
regards international relations; the privacy and integrity of the individual regarding the protection of 
personal data in accordance with Regulation 2018/1725; the commercial interests of a natural or 
legal person; ongoing or closed investigations; the decision-making process of the EDPB, in relation 
to matters upon which a decision has not yet been taken and/or the decision-making process of the 
EDPB, in relation to matters upon which a decision has been taken.” 

The EDPB Secretariat will not be bound by this analysis with regard to future access requests as any 
request should be evaluated at the time it is received and information redacted at one moment 
could be disclosed later if the exemptions used are no longer relevant. 


4 CONFIDENTIALITY 


In accordance with Article 76 (1) GDPR and Article 33 (1) RoP discussions shall only be declared to be 
confidential if they concern a specific individual, the consistency mechanism (i.e. Article 64 GDPR 
procedures) or if the Board decides that the discussions on a specific topic shall remain confidential, 
for instance when the discussions concern international relations (i.e. adequacy decisions) and/or 
where the absence of confidentiality would seriously undermine the institutions’ decision-making 
process, unless there is an overriding public interest in disclosure (i.e. updates by national SAs on 
current investigations, discussions of new working methods). 

The consequence is that the members cannot share (i.e. via social media) the content of the 
discussions relating to those points. However, the decisions made relating to those points are 
recorded in the minutes and subject to access to documents requests and the documents adopted 
are generally published. 

A declaration of confidentiality should only be made where the content of the discussion relates to a 
specific topic listed in Article 33 of the RoP. In such an exceptional case, the Chair should indicate 
those agenda items when the draft agenda is circulated and provide reference to the relevant point 
under Article 33 (1) RoP. If necessary, a decision by the Board should be sought. 

In future, the reasons for the declaration of confidentiality should be briefly stated in the minutes (at 
least the exact reference to the relevant subsection of Article 33 (1) RoP should be cited). 
Furthermore, the list of topics that will be subject to confidentiality will be listed at the beginning of 
the minutes and will contain a generic footnote clarifying that this notion of “confidentiality” is not to 
be understood as classified information but in line with art 76 (1) GDPR . The practical consequence 
of the application of Art 76 (1) GDPR is that the members and observers are under the legal duty to 
not reveal to the public elements of the discussions that are not otherwise published, either in the 
minutes or the adopted documents. 
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